Microsoft Sentinel SIEM Engineer

Role & responsibilities

We are looking for a skilled Microsoft Sentinel SIEM Engineer to join our Cybersecurity Operations team. The ideal candidate will be responsible for the deployment, configuration, integration, and operational support of Microsoft Sentinel as a core SIEM platform, ensuring efficient threat detection, incident response, and security monitoring.

Key Responsibilities:

• Design, implement, and manage Microsoft Sentinel for enterprise security monitoring.
• Develop and maintain analytic rules (KQL-based) and detection use cases aligned with MITRE ATT&CK.
• Integrate various log sources (on-prem and cloud) including Microsoft 365, Azure, AWS, endpoints, firewalls, etc.
• Create and manage playbooks using Azure Logic Apps for automated incident response.
• Monitor data connectors and ensure log ingestion health and optimization.
• Conduct threat hunting and deep dive analysis using Kusto Query Language (KQL).
• Optimize performance, cost, and retention policies in Sentinel and Log Analytics workspace.
• Collaborate with SOC analysts, incident responders, and threat intelligence teams.
• Participate in use case development, testing, and fine-tuning of alert rules to reduce false positives.
• Support compliance and audit requirements by producing relevant reports and documentation.

Required Skills & Qualifications:

• 3+ years of experience working with Microsoft Sentinel SIEM.
• Strong hands-on experience with

  KQL (Kusto Query Language)

  .
• Solid understanding of log ingestion from different sources including Azure, O365, Defender, firewalls, and servers.
• Experience with

  Azure Logic Apps

  for playbook creation and automation.
• Familiarity with incident response workflows and threat detection methodologies.
• Knowledge of security frameworks such as

  MITRE ATT&CK, NIST, or ISO 27001

  .
• Microsoft certifications such as

  SC-200

  (Microsoft Security Operations Analyst) or

  AZ-500

  are preferred.

Good to Have:

• Experience with Defender for Endpoint, Defender for Cloud, Microsoft Purview.
• Knowledge of other SIEM platforms (e.g., Splunk, QRadar) for hybrid environments.
• Scripting experience (PowerShell, Python) for automation and integration.

Certifications (Preferred but not mandatory):

• SC-200

  : Microsoft Security Operations Analyst

• AZ-500

  : Microsoft Azure Security Technologies

• CEH

  ,

  CompTIA Security+

  , or equivalent